ScopeWeaver

Mentions · 7d1
Mentions · 30d1
All mentions1
First seenOct 30, 2026
Last mentioned2d ago

Timeline

1 articles · newest first

Threat Actors Abuse Agentic Frameworks ARTEX and CAIRN for Automated Intrusions

Mandiant and GTIG observe ARTEX, Hexstrike, and CAIRN used by threat actors in live incidents since August 2026, enabling rapid lateral movement and exfiltration.

Google Threat Intelligenceupdated 08:23 UTC · 1h agofirst Oct 30, 14:00 UTC · 2d agoThreat actorExploited6 sources1

Appears with

CAIRNproduct · 1
ARTEXproduct · 1
Wiz Researchorganization · 1
UNC7228threat actor · 1
Hexstrikeproduct · 1
STORM-0940threat actor · 1
Mandiantvendor · 1
ARTEX PROproduct · 1
PentAGIproduct · 1
Googlevendor · 1

Entities are extracted by the model from each article. First seen Oct 30, 2026, last mentioned 2d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.